Privacy Policy

This policy explains what personal data AI eBook Suite (the website aiebooksuite.com and the services offered on it, together the "Service") collects, why, who receives it, how long it is kept and which rights you have. We wrote it to match how the Service actually works today.

1. Who is responsible for your data

The data controller is:

For any privacy question or request, write to info@aiebooksuite.com. We have not appointed a data protection officer, as we are not required to.

2. What we collect

2.1 Data you give us

• Account: email address, password (stored only as a bcrypt hash, never in readable form), and optionally first and last name. We also store when the account was created and whether the email address is confirmed.
• Subscription: payments are handled by Stripe. We never see or store your card details; we keep your Stripe customer ID, subscription ID and subscription status.
• AI provider API keys: the provider (OpenAI or OpenRouter), an optional nickname and the key itself, encrypted before it is saved. The key is decrypted only on our server, at the moment a generation needs it.
• eBook projects: what you enter in the generator (topic, brief, genre, style, language, author name, title, dedication, length settings, chosen provider and model), the book plan and chapters the AI writes, the finished files, and the status and progress of each generation.
• Free demo: the topic and language you type, and the sample the AI writes for it (title, outline and first chapter). You do not need an account; if you are logged in, or log in afterwards in the same browser, the sample is linked to your account.
• Messages: what you send us by email, and what you type in the support chat if you have accepted it.

2.2 Data collected automatically

• Technical and security data: IP address, browser type, requested pages, date and time, recorded in our server logs. To enforce limits (for example the number of free samples or login attempts per day) we keep short-lived counters keyed on a hashed IP address or account identifier.
• Bot protection: on the login, sign-up, password-reset and free-demo pages we use Google reCAPTCHA, which collects information about your device and how you interact with the page to tell people from bots.
• Statistics (only with your consent): Google Analytics collects information on how the site is used, such as pages viewed, approximate location and device type.
• Cookies: see our Cookie Policy.

We do not make decisions about you based solely on automated processing, and we do not sell personal data or use it for advertising profiles.

3. Purposes and legal bases

4. Service providers and other recipients

We use the following providers. Those acting as our processors only handle data on our instructions and under a data processing agreement.

• Hostinger International Ltd. (Cyprus): hosting of our server (a virtual server located in Germany) and the mailbox that sends our service emails.
• Stripe (Stripe Payments Europe, Ltd., Ireland, and its group companies): payment processing and the subscription billing portal. Stripe also processes payment data as an independent controller for fraud prevention and its legal obligations.
• OpenAI and OpenRouter, with your own key: when you start or resume a generation, we send your inputs and the text written so far to the AI provider you chose, using your API key. You are that provider's customer and its own terms and privacy policy apply to what it receives. OpenRouter forwards each request to the company that runs the model you selected.
• OpenRouter, Inc. (USA), with our key, for the free demo: the demo topic and language are sent to OpenRouter under our account, which forwards them to the provider of the demo model (currently a model made by OpenAI). Please do not type personal or confidential information in the demo.
• Google (Google Ireland Ltd. and Google LLC): reCAPTCHA (security); Google Analytics (only after you accept).
• ChatNode (chatnode.ai): the support chat widget, loaded only after you accept optional cookies.
• cdnjs (operated by Cloudflare, Inc.): a public content delivery network from which a few of our pages load an icon font; it receives your IP address like any web server you connect to.

We may also disclose data where the law requires it (for example to courts or authorities), to defend legal claims, or to a buyer of the business if the Service is ever transferred, in which case this policy continues to apply to your data.

5. Transfers outside the European Economic Area

Some providers listed above (Stripe, OpenAI, OpenRouter, Google, ChatNode, Cloudflare) are based in, or may process data in, countries outside the EEA, in particular the United States. When this happens, the transfer relies on a European Commission adequacy decision (such as the EU-U.S. Data Privacy Framework, for companies certified under it) or on the European Commission's Standard Contractual Clauses. When you use your own API key, the transfer to your AI provider happens because you ask us to send your request to that provider.

6. How long we keep data

• Account and profile: until you ask us to delete your account. Accounts are deleted within 30 days of a request.
• eBook projects and files: until you delete them (the Delete button in My eBooks removes the project and all its files from our server) or your account is deleted.
• API keys: until you delete or replace them on the API Keys page, or your account is deleted.
• Free demo samples: 24 hours, then deleted automatically. Daily usage counters expire within two days.
• Billing records: as long as tax and commercial law requires (in Spain, generally up to six years).
• Server logs: deleted automatically after a few weeks (at most about five weeks).
• Analytics data: according to the retention period set in our Google Analytics account, at most 14 months.
• Emails with us: as long as needed to handle your request and any follow-up.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive the data you gave us in a portable format, and to withdraw any consent at any time (this does not affect processing that happened before). To exercise a right, email info@aiebooksuite.com from the address of your account; we may ask you to confirm your identity. We answer within one month.

You can correct your name and email address yourself under My Profile, and delete eBooks and API keys yourself at any time. To delete your whole account, cancel any active subscription under Manage Subscription and then email us.

If you think we have not handled your data properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority of the country where you live. We would appreciate the chance to sort it out with you first.

Residents of some non-EU jurisdictions, such as California, may have additional rights under local law (for example to know what data we hold and to request its deletion). We do not sell or share personal data for cross-context behavioural advertising.

8. Security

The site is served only over HTTPS. Passwords are stored as bcrypt hashes and API keys are encrypted before being saved. Forms are protected against cross-site request forgery, logins and other sensitive actions are rate-limited, and access to the server is restricted. No system is perfectly secure; if a breach affecting your data occurs, we will inform you and the authority as the law requires.

9. Minimum age

The Service is intended for adults. You must be at least 18 years old to create an account (see our Terms of Service). We do not knowingly collect data from children; if you believe a child has given us personal data, contact us and we will delete it.

10. Cookies

We use only the cookies needed to run the site, unless you accept optional ones. Details, and how to change your choice, are in our Cookie Policy.

11. Changes to this policy

We will update this policy when the Service or the law changes, and change the date at the top. If a change materially affects how we use your data, we will tell you by email or with a notice on the site before it takes effect.